Privacy Policy

This Privacy Policy (“Policy”) explains how Hold On World ("Hold On World," "we," "us," or "our"), a trade name (doing business as) operated by Anette Erazo, an individual sole proprietor domiciled in Quito, Pichincha, Ecuador, collects, uses, discloses, retains, and protects personal information obtained through the website located at holdonworld.shop (the "Site"), together with any related sales, customer service, and marketing activities (collectively, the "Services"). This Policy also describes, in a single consolidated document, how your personal data is used ("Data Usage"), so that you have one authoritative source of truth rather than multiple, potentially conflicting documents.

By accessing or using the Site, placing an order, subscribing to communications, or otherwise providing us with personal information, you acknowledge that you have read, understood, and, where required by applicable law, consented to the practices described in this Policy. If you do not agree with this Policy, you should not use the Site or provide us with personal information.

1. Who We Are — Identification of the Data Controller

Hold On World is not, as of the date of this Policy, incorporated or registered as a corporate entity in any jurisdiction, including Ecuador or the United States. Hold On World is a commercial trade name under which Anette Erazo conducts business as a natural person (persona natural), for tax and civil liability purposes, under the laws of the Republic of Ecuador. Accordingly, for all purposes of this Policy, applicable data protection law, and any consumer protection statute, the "data controller" (or "responsable del tratamiento" under Ecuadorian law) and the party with whom you are contracting is:

Anette Erazo, operating under the trade name "Hold On World," domiciled in Quito, Pichincha, Ecuador.

We disclose this corporate status transparently and without qualification. Nothing on the Site, in our marketing, or in this Policy should be construed as a representation that Hold On World is a corporation, limited liability company, or other registered legal entity. Should Hold On World or its parent creative concept be formally incorporated in the future, this Policy will be updated accordingly and republished with a new effective date.

2. Scope of This Policy

This Policy applies to personal information collected through the Site, through email, SMS, or social media communications you initiate with us, and through any order placed with Hold On World regardless of the device or platform used to place it. It does not apply to third-party websites, applications, or services that may be linked from the Site, including the platforms of our service providers, which maintain their own privacy policies as described in Section 9 below.

3. Categories of Personal Data We Collect

We collect the following categories of personal information, depending on how you interact with the Site:

3.1 Information You Provide Directly

—   Identification data: full name, billing and shipping address, email address.

—   Order and transaction data: products purchased, order value, order history, size and color selections, gift messages, and promotional codes used.

—   Payment-related data: payment is processed entirely by third-party payment processors made available through our Shopify checkout (which may include Shopify Payments, PayPal, and other providers Shopify enables from time to time). We do not directly collect, view, or store full payment card numbers, card verification values, or bank account credentials.

—   Communications: content of emails, contact-form submissions, or social media messages you send us, including customer service inquiries, refund requests, and feedback.

—   Marketing preferences: your choice to subscribe to or unsubscribe from email or SMS marketing communications.

3.2 Information Collected Automatically

—   Device and technical data: IP address, browser type and version, operating system, device identifiers, and general geographic location inferred from your IP address.

—   Usage data: pages viewed, time spent on the Site, referring and exit pages, links clicked, and cart or checkout behavior.

—   Cookie and pixel data: information collected through cookies, pixels, and similar tracking technologies, as described in detail in our separate Cookie Policy, which is incorporated into this Policy by reference.

3.3 Information Received From Third Parties

—   From Shopify Inc. ("Shopify"), our e-commerce hosting platform, which processes order, account, and checkout data on our behalf.

—   From Printify, Inc. ("Printify"), our print-on-demand fulfillment partner, to the limited extent necessary for order fulfillment (see Section 9).

—   From advertising and analytics partners, including Meta Platforms, Inc. (Meta Pixel), TikTok Inc. (TikTok Pixel), and Google LLC (Google Analytics), which may share aggregated or pseudonymized audience and conversion data with us.

4. How We Collect Your Information

We collect personal information (a) directly from you when you browse the Site, create an account (if applicable), place an order, contact customer service, or subscribe to marketing communications; (b) automatically through cookies, pixels, and server logs when you interact with the Site; and (c) from the third-party service providers identified throughout this Policy, who collect or transmit data to us in connection with hosting, payment processing, fulfillment, and marketing measurement.

5. How We Use Your Information (Purposes of Processing)

We use personal information only for the following purposes, and we do not use personal information for any purpose incompatible with those listed below without providing you notice and, where required, obtaining your consent:

—   To process, fulfill, and ship your order, including transmitting your name, shipping address, and product specifications to Printify for production and delivery.

—   To communicate with you regarding your order status, shipping confirmations, customer service inquiries, and refund or reprint requests.

—   To operate, maintain, secure, and improve the Site, including diagnosing technical issues and preventing fraudulent transactions.

—   To send you marketing communications by email or SMS, where you have opted in, and to allow you to opt out at any time as described in Section 13.

—   To measure and improve the performance of our advertising campaigns on Meta and TikTok platforms and to analyze aggregate Site traffic through Google Analytics.

—   To comply with applicable legal, tax, and accounting obligations in Ecuador and, where applicable, the United States.

—   To establish, exercise, or defend legal claims.

We do not sell personal information to third parties for monetary consideration, and we do not knowingly permit third parties to use personal information collected on the Site for their own independent marketing purposes beyond the advertising-measurement functions described in this Policy and our Cookie Policy.

6. Legal Bases for Processing

Because Hold On World is operated by a natural person domiciled in Ecuador, the primary framework governing our processing activities is Ecuador's Ley Orgánica de Protección de Datos Personales (Organic Law on Protection of Personal Data, "LOPDP") and its implementing regulation (Reglamento General a la LOPDP, Executive Decree No. 904). Under the LOPDP, we process your personal data on the following legal bases, as applicable:

—   Performance of a contract: to process and fulfill an order you have placed with us.

—   Consent: for marketing communications and for non-essential cookies, which you may withdraw at any time.

—   Legitimate interest: for fraud prevention, Site security, and aggregate analytics, balanced against your fundamental rights.

—   Legal obligation: to comply with tax, accounting, and consumer protection requirements in Ecuador.

We recognize that the substantial majority of our customers are located in the United States. As a matter of policy, and independent of the strict territorial scope of Ecuadorian law, we extend the transparency and disclosure practices described in this Policy to all visitors and customers regardless of location, in keeping with the general standards applicable to commercial websites serving United States consumers, including the disclosure principles reflected in the California Online Privacy Protection Act (CalOPPA) and the general prohibition on unfair or deceptive practices enforced by the U.S. Federal Trade Commission (FTC).

7. Disclosure of Your Information to Third Parties

We disclose personal information only to the following categories of recipients, and only to the extent reasonably necessary for the purposes described in this Policy:

Recipient	Category of Data Shared	Purpose
Shopify Inc.	Order data, checkout data, account data, technical data	E-commerce platform hosting, checkout processing, and store administration
Printify, Inc. (and its network of independent print providers)	Name, shipping address, order/product specifications	Manufacturing, printing, and shipping of your order
Payment processors enabled via Shopify Checkout (e.g., Shopify Payments, PayPal)	Payment and limited transaction data	Secure processing of your payment; we do not receive or store full card details
Meta Platforms, Inc.	Pseudonymized device/browser identifiers, page-view and purchase events	Advertising measurement and ad personalization on Facebook and Instagram
TikTok Inc.	Pseudonymized device/browser identifiers, page-view and purchase events	Advertising measurement and ad personalization on TikTok
Google LLC (Google Analytics)	Pseudonymized device/browser identifiers, usage data	Aggregate website traffic analysis
Government or regulatory authorities	As legally compelled	Compliance with a valid legal, tax, or judicial request

We do not permit any of the recipients listed above to use your personal information for purposes beyond those described in their respective role, except as independently permitted or required by their own applicable privacy policies and terms, which we encourage you to review: Shopify's Privacy Policy, Printify's Privacy Policy, Meta's Data Policy, TikTok's Privacy Policy, and Google's Privacy Policy.

8. International Transfers of Data

Because our Site is hosted on Shopify's infrastructure and our fulfillment partner Printify operates internationally, your personal information will, in the ordinary course of business, be transferred to and processed in the United States and potentially other countries where these providers or their sub-processors maintain servers or facilities. These countries may have data protection laws that differ from those of Ecuador. Where required by the LOPDP's rules on international data transfers, we rely on the contractual and organizational safeguards implemented by our service providers (including their own compliance frameworks and, where applicable, standard contractual clauses) to ensure an adequate level of protection for your personal data during such transfers.

9. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Policy, including:

—   Order and transaction records: retained for the period required by applicable Ecuadorian tax and commercial accounting law (generally up to seven (7) years), and to handle warranty, reprint, or refund claims.

—   Marketing contact data: retained until you unsubscribe or withdraw consent, after which we will suppress or delete your contact information within a reasonable period, except where retention is required to honor your opt-out request itself.

—   Cookie and analytics data: retained according to the durations specified in our Cookie Policy.

10. Data Security

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction, including relying on the security infrastructure provided by Shopify (which maintains PCI-DSS compliance for payment processing) and restricting access to personal information to what is reasonably necessary to operate the Services. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

11. Your Privacy Rights

11.1 Rights Under Ecuadorian Law (LOPDP)

If Ecuadorian law applies to you, or in any event as a matter of policy extended to all data subjects, you have the right to:

—   Access: request confirmation of whether we process your personal data and obtain a copy of it.

—   Rectification: request correction of inaccurate or incomplete personal data.

—   Cancellation/Deletion: request deletion of your personal data when it is no longer necessary for the purposes for which it was collected.

—   Opposition: object to the processing of your personal data for specific purposes, including direct marketing.

—   Portability: request your personal data in a structured, commonly used format.

—   Withdrawal of consent: withdraw previously given consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

You may exercise these rights by contacting us at info@holdonworld.shop. We will respond within the timeframes established by the LOPDP and its implementing regulation. If you are not satisfied with our response, you have the right to file a complaint with Ecuador's Superintendencia de Protección de Datos Personales (SPDP).

11.2 Notice to Residents of the United States

Hold On World is a small, sole-proprietor operation. Based on our current order volume, we do not meet the consumer-volume or revenue thresholds that trigger obligations under comprehensive U.S. state privacy statutes (such as those of California, Colorado, Connecticut, Virginia, and other states that generally apply only to entities processing the personal data of tens of thousands of consumers annually or deriving a majority of revenue from data sales). Notwithstanding the foregoing, as a matter of good-faith policy and consistent with the transparency principles of the California Online Privacy Protection Act (CalOPPA), we will honor reasonable, verifiable requests from United States residents to access, correct, or delete their personal information, and to opt out of the sale or sharing of personal information (which, for the avoidance of doubt, we do not engage in) by contacting us at the email address above.

12. Cookies and Similar Technologies

The Site uses cookies, pixels, and similar tracking technologies to operate the checkout, remember your preferences, and measure advertising performance. Full details regarding the categories of cookies we use, their purposes, retention periods, and how to manage your preferences are set out in our separate Cookie Policy, which forms an integral part of this Privacy Policy.

13. Children's Privacy

The Site and the Services are directed to adults and are not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under eighteen (18), we will take reasonable steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us using the details in Section 18.

14. Third-Party Links

The Site may contain links to third-party websites, including social media platforms. This Policy does not apply to, and we are not responsible for, the privacy practices of any third-party website. We encourage you to review the privacy policy of any third-party site you visit.

15. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, our service providers, or applicable law. The "Last Updated" date at the top of this Policy indicates when it was last revised. Material changes will be reflected by posting the revised Policy on the Site. Your continued use of the Site following the posting of changes constitutes acceptance of those changes.

16. Governing Law and Jurisdiction

This Policy, and any dispute arising out of or relating to it or to the processing of your personal data by Hold On World, shall be governed by and construed in accordance with the laws of the Republic of Ecuador, without regard to its conflict-of-laws principles, and any such dispute shall be submitted to the competent courts of Quito, Pichincha, Ecuador, except where applicable mandatory consumer-protection law grants you the right to bring a claim in your local jurisdiction, in which case such mandatory law shall prevail to the extent required.

17. Contact Us

If you have questions, concerns, or requests regarding this Policy or our data practices, please contact us at:

Hold On World

Operated by Anette Erazo · Quito, Pichincha, Ecuador

Email: info@holdonworld.shop

We do not currently maintain a customer service telephone line; email is the fastest way to reach us.